MojoPortal XSS Jul 30 2013 12:08PM
vulns dionach com
Class Stored Cross-Site Scripting
Remote Yes
Credit Michael Savage of Dionach (vulns (at) dionach (dot) com [email concealed])
Vulnerable MojoPortal

MojoPortal is prone to a stored cross-site scripting vulnerability because it
does not escape the titles of forum threads when inserting into the page title

An attacker may leverage this issue to run JavaScript in the context of another
user's browser.

MojoPortal is known to be vulnerable. Other versions may also be

To exploit this issue, an attacker must create a crafted post, for example:

POST /Forums/EditPost.aspx [txtSubject=+</title><script>alert("XSS!")</script>]

The vendor has released an updated version ( which is believed to
resolve this issue. See the announcement at

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus